Check AWS CLI v2
The audit uses the normal AWS credential chain. A named profile keeps the demo explicit and easy to review.
Narrated enterprise walkthrough
See the complete FinOps Audit journey.
A detailed illustrative AWS estate shows how the audit moves from CLI identity checks to tagging maturity, cost-allocation readiness, spend visibility and a prioritised evidence pack.
Illustrative data · no customer identifiersRead-only Layer 1No AdministratorAccess requiredNo initial IaC baseline required
59 SEC CLI WALKTHROUGHREAD ONLYAWS CLI V2NO IAC REQUIRED
Dockfield FinOps Audit demo
From AWS profile.
To FinOps evidence.
See the intended Layer-1 customer experience: verify AWS CLI v2, select a named read-only profile, confirm the identity, run one Nuitka command and review the resulting FinOps evidence pack.
Illustrative technical-preview walkthrough. The commands and output format show the intended public interface. This is not presented as a live production-account recording. Real credentials are never shown.
PrereqsCLI + identity
→
VerifySTS identity
→
Auditone binary
→
EvidenzeHTML/CSV/JSON
→
Decidereno writes
01 · Prerequisites
AWS CLI v2 and an authorised read-only identity.
$ aws --version
aws-cli/2.x Python/3.x Darwin/arm64
✓ AWS CLI v2 detectedCreate or choose the profile
Static access key / secret key is one possible demo path, but it is not mandatory. For real customers, IAM Identity Center or temporary role credentials are preferred where available.
$ aws configure --profile dockfield-finops
AWS Access Key ID [None]: AKIA****************
AWS Secret Access Key [None]: ********************************
Default region name [None]: eu-west-2
Default output format [None]: json
Masked placeholders only. Never record a real secret.02 · Identity gate
Verify the account before the scan.
Confirm caller identity
The operator checks the account and role before discovery. The intended Layer-1 role is read-only; AdministratorAccess is not required.
$ aws sts get-caller-identity --profile dockfield-finops
{
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/
DockfieldFinOpsReadOnly/finops-audit"
}
✓ Expected account · read-only audit role03 · One public command
Run the Nuitka FinOps Audit.
$ ./dockfield-finops audit \
--profile dockfield-finops \
--regions all \
--output ./finops-audit
[1/4] DISCOVER AWS resources + ownership signals
[2/4] TAG AUDIT required / missing / invalid tags
[3/4] COST ALLOCATION active / inactive / pending tag keys
[4/4] REPORT HTML + CSV + JSON evidence
PASS Audit completed without changing AWS resourcesWhat runs behind the binary
Four internal stages. One customer-facing executable.
0101_discover.py
→
0202_tag_audit.py
→
0303_cost_allocation.py
→
0404_report.py
Public distribution: customers run
dockfield-finops. The Python stage names describe the development architecture; the Nuitka package does not require publishing the Python source.04 · Evidence
The audit ends with files, scores and zero AWS writes.
Review the output directory
The HTML report is for people; CSV and JSON are suitable for analysis, evidence and downstream automation.
$ find ./finops-audit -maxdepth 1 -type f | sort
assessment.html
compliance.csv
compliance.json
cost-allocation.json
inventory.json
manifest.json
FinOps Score: 78 / 100
Tag Coverage: 81.6%
Cost Allocation Ready: 3 active · 2 inactive
AWS writes performed: 0Tag coverageSee which resources lack the FinOps allocation model.
Cost allocation readinessSee which tag keys are active, inactive or waiting for visibility.
Next decisionStop at audit, or move to controlled Remediation / Transformation.
Layer 1 · Free technical preview
Audit first. Change nothing.
No Terraform baseline is required, and the free audit does not ask for AdministratorAccess.